Tokens and scopes
Two kinds of credential
Section titled “Two kinds of credential”- Connected apps (OAuth): the CLI, Claude, ChatGPT, Cursor. You approve scopes on a consent screen; access tokens are short-lived and refresh themselves.
- Personal tokens (
qrm_pat_...): for scripts and CI. Create one in Settings → Developer. It is shown once and stored only as a hash. Tokens require an expiry (90 days by default, one year at most), you get a warning 7 days before, and one unused for 90 days is revoked.
Both act as you. Neither can create or approve tokens: that needs your signed-in session.
Scopes
Section titled “Scopes”A credential’s permission is its scopes intersected with your role right now: demote someone and their tokens lose the power immediately. …:write implies …:read. A credential can also be limited to chosen orgs; org-limited credentials can’t change things shared across orgs (your schedules, your handle).
workspace:admin is for org administration: members and their emails, invites, teams, policies and webhooks. Contacts are asked for by name.
Org policies
Section titled “Org policies”Org admins control how tokens and apps reach their org, in the org’s Developer tab:
- Allow personal tokens and Require admin approval (off by default).
- Allow connected apps, its own approval switch, and an allowlist of OAuth clients (say, Claude) whose members connect without waiting.
- Admins see and can turn off every token and app that reaches the org.
Errors
Section titled “Errors”A missing scope is 403 with error: "insufficient_scope" and a WWW-Authenticate header naming it. A policy refusal is 403 with a code such as credentials_disabled or approval_pending.